We did a PCI scan for one of our clients and it says they failed due to the SSL certificate, for SMTP Port 25, not matching the domain scanned. Here's what it said: Description: SSL Certificate with Wrong Hostname Synoposis: The SSL certificate for this service is for a different host. Impact: The...

I have to deploy some file integrity monitoring / intrusion detection software on our AWS instances. We wanted to use OSSEC but we realized it doesn't work well in our environment (our servers auto deploy and shut down based on load). What should we use that covers PCI DSS on AWS (hopefully it's...

For PCI DSS requirements, if a session is idle for more than 15 minutes, the user will have to re-authenticate to re-activate the terminal or session. So, because of this, we had to deal with SSH sessions that are idling at the bash prompt by enforcing a global $TMOUT of 900. But we realized that...

Recently, I've been looking to use Authorize.NET (CIM and DPM solutions). However, we can't reference a CIM profile in the DPM. Basically, I need to become PCI compliant because this handles credit cards. Here's my question: Is there something similar to Authorize.NET that allows our site to never...

We have a Fedora server that's running on Apache to pass a PCI DSS compliance scan by McAfee. Here's what we used for the default SSLCipherSuite and SSLProtocol. SSLProtocol ALL -SSLv2 SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP So it failed because of weak ciphers. We changed it...

We are migrating users from one exchange server to another. the users sit in remote sites and use very slow links to connect to the exchange server. Is it possible to use the old ost on the pc for the new exchange server instead of recreating the ost with the new exchange server, which can take...

Due to PCI compliance, we have to disable plaintext authentication. We were able to do this through encapsulating communications between our mail server and clients with TLS on port 465. Here's where the problem is: Port 25 has to remain open / unencrypted for us to receive mail, but it shouldn't...

I've been working on our PCI DSS assessment. I already know that passwords must be changed every 90 days / different than previous passwords. But I'm not sure if this is for access to the server or to the app we provide to users on the server. If it's the second part, can we enforce this in ASP.NET...

We're working on a website that would allow our users to pay with their credit cards. We're outside of the country so we can't use a normal merchant account (like Braintree). Does anyone happen to know of a credit card service that would allow us to store credit card info and access them through an...

From what I understand, storing a shipping address would be okay for PCI compliance right? Do configuration standards include requirements for a firewall at each Internet connection? Is there a process for approving and testing all external network connections? I'm leaning towards no but I need to...

Hi, I'm 16 years old and I was thinking about following a career in information security and I just can't find any good place to teach me the basics of this and school doesn't help me at all cause we are not teached anything like that. Thanks for your time and have a good day!

My client has an e-commerce which accepts payments through a payment gateway integration that transfers the control to payment gateways. But it knows that it needs to be PCI compliant for accepting credit card information. Instead, could our client use stripe payment gateway / integration that it...

For one of our client's websites, they're trying to pass PCI compliance test but the testing company notified us of a vulnerability that we can't figure out. Here's what they told us: The issue here is a cross-site scripting vulnerability that is commonly associated with e-commerce applications....

We're running a Windows Server 2008 with IIS 7. I need to use SSL 3.0 for our PCI compliance but from what I was told, we should disable SSL 2.0. But if I need to do this, will IIS automatically use SSL 3.0? Thanks!

We're currently comparing solutions for PCI DSS compliance including: Splunk, RSA enVision, ArcSight, etc. But we're not sure what to do with. Has anyone had any experience with these programs? Our PCI system is a small segmented network with 5 hosts and our machines will be running Linux. Thanks!

I understand that PCI compliance requires annual rotation of keys. So, I have 16 databases across 3 servers (with multiple tables in each database). And it's going to get bigger. If I did this manually, it would make my data unreadable. Is there a software to do this?

My department needs an open source static source code analysis tool that's going to be used for security testing on an Android app. We need to make sure the app is PCI compliant. Anyone know of a software that we can use for this?

To follow this tag...

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States.
Privacy